How do you design a secure over-the-air (OTA) update system for vehicles?

OTA update architecture includes: Backend infrastructure (update packages, campaign management, fleet monitoring), vehicle gateway for update coordination, secure download channel (TLS, certificate verification), code signing and authentication (PKI infrastructure), delta update generation for bandwidth efficiency, A/B partitioning for rollback capability, dependency management across ECUs, and installation sequencing considering vehicle state. Safety considerations include ensuring vehicle remains operational during updates, handling partial update failures, and validating updates before activation. Diagnostic and rollback mechanisms are essential. UNECE R156 mandates software update management systems.